Synthesis of Supremal Successful Normal Actuator Attackers on Normal Supervisors

Abstract

In this work, we propose and develop a new discrete-event based actuator attack model on the closed-loop system formed by the plant and the supervisor. We assume the actuator attacker partially observes the execution of the closed-loop system and eavesdrops the control commands issued by the supervisor. The attacker can modify each control command on a specified subset of attackable events. The attack principle of the actuator attacker is to remain covert until it can establish a successful attack and lead the attacked closed-loop system into generating certain damaging strings. We present a characterization for the existence of a successful attacker, via a new notion of attackability, and prove the existence of the supremal successful actuator attacker, when both the supervisor and the attacker are normal (that is, unobservable events to the supervisor cannot be disabled by the supervisor and unobservable events to the attacker cannot be attacked by the attacker). Finally, we present an algorithm to synthesize the supremal successful attackers that are represented by Moore automata.Keywords cyber-physical systems · discrete-event systems · supervisory control · actuator attack · partial observation IntroductionRecently, cyber-physical systems have drawn much research interest within the discreteevent systems and formal methods community [1]

Towards Bounded Synthesis of Resilient Supervisors

“…Φ sa f e can specify the state avoidance property (i.e., the avoidance of certain states in the plant) or more general safety property [11]. In [3] and [11], the attackers are assumed to be covert. That is, the attacker needs to remain covert in the course of attacking the closed-loop systems until damages are inflicted upon the attacked closed-loop systems.…”

“…Thus, to synthesize a resilient supervisor against covert attackers, we let Φ assume = Φ covert . On the other hand, if we let Φ assume = True, then the covertness requirement is removed and each synthesized resilient supervisor, if any, needs to guard against the damages caused by risky attacks [11].…”

“…In this subsection, we recall two problems, i.e., the supervisor obfuscation problem [12] and a formulation of the resilient supervisor synthesis problem [11]. C , if it exists, such that 1) L(G 1 ) ⊆ L(S G) ⊆ L(G 2 ) and 2) there is no successful attacker on (G, S) w.r.t.…”

“…The safety of cyber-physical systems (CPS) against adversarial attacks has recently drawn much research interest from both the discrete-event systems and formal methods community [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12]. For a recent survey and position paper on the discrete-event systems based approach, the reader is referred to [13].…”

“…• We provide a generalized formulation of actuator attack. Compared with [11], [12], we allow general control constraints on the supervisors and general attack constraints on the attackers. • We model each actuator attacker as a Moore automaton and propose a new composition operator to construct the attacked closed-loop system, for any given plant, supervisor and actuator attacker.…”